Fingerprinting JPEGs With Optimised Huffman Tables

McKeown, Sean; Russell, Gordon; Leimich, Petra

Abstract

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given medium, and comparing individual digests with a database of known contraband. However, the large capacities of modern storage media and time pressures placed on forensics examiners necessitates the development of more efficient processing methods. This work describes a technique for fingerprinting JPEGs with optimised Huffman tables which requires only the image header to be present on the media. Such fingerprints are shown to be robust across large datasets, with demonstrably faster processing times.

Citation

McKeown, S., Russell, G., & Leimich, P. (2018). Fingerprinting JPEGs With Optimised Huffman Tables. Journal of Digital Forensics, Security and Law, 13(2), Article 7. https://doi.org/10.15394/jdfsl.2018.1451

• Journal Article Type: Article
• Acceptance Date: Oct 12, 2017
• Publication Date: 2018-10
• Deposit Date: Oct 18, 2017
• Publicly Available Date: Oct 18, 2017
• Journal: The Journal of Digital Forensics, Security and Law
• Print ISSN: 1558-7215
• Electronic ISSN: 1558-7223
• Publisher: Association of Digital Forensics, Security and Law
• Peer Reviewed: Peer Reviewed
• Volume: 13
• Issue: 2
• Article Number: 7
• DOI: https://doi.org/10.15394/jdfsl.2018.1451
• Keywords: digital forensics, image comparison, image processing, known file analysis, partial file analysis
• Public URL: http://researchrepository.napier.ac.uk/Output/997464
• Publisher URL: http://commons.erau.edu/jdfsl/